Title:
Should not mark some tag-specific variables as XSS (RecordCount/CurrentRow)
| View in TrackerStatus/Resolution/Reason: Closed/Withdrawn/Duplicate
Reporter/Name(from Bugbase): David Epler / David Epler (David Epler)
Created: 03/09/2016
Components: Security Analyzer
Versions: 2016
Failure Type:
Found In Build/Fixed In Build: CF2016_Final /
Priority/Frequency: Major / All users will encounter
Locale/System: ALL / Win 2008 Server R2 64 bit
Vote Count: 0
Duplicate ID: CF-4087973
Problem Description:
Given the code:
<cfquery name="listing" datasource="cfartgallery">
SELECT ARTISTID, FIRSTNAME, LASTNAME, EMAIL, THEPASSWORD, ADDRESS, CITY, STATE, POSTALCODE, PHONE, FAX
FROM ARTISTS
WHERE 1=1
</cfquery>
<cfoutput>
<h1>#listing.recordCount#</h1>
<ul>
<cfloop query="listing">
<li>#listing.currentRow# - #encodeForHTML(listing.lastName & ", " & listing.firstName)#</li>
</cfloop>
</ul>
</cfoutput>
Actual Result:
listing.recordCount and listing.currentRow are marked as XSS, Error, High
Expected Result:
They should not be marked or at least be reduced in type and severity. Both are tag-specific variables, are system generated, and are integers.
Other tag-specific variables should also follow this:
cfquery/cfldap/cfpop/cfsearch
queryname.CurrentRow
queryname.RecordCount
CFQUERY.ExecutionTime
CFSTOREDPROC.ExecutionTime
CFSTOREDPROC.StatusCode
Any Workarounds:
None
----------------------------- Additional Watson Details -----------------------------
Watson Bug ID: 4126922
External Customer Info:
External Company:
External Customer Name: David Epler
External Customer Email:
External Test Config: My Hardware and Environment details:Attachments:
Comments: